Menu
Menu
Table of contents
Public Key Infrastructure provides the issuance of digital certificates and digital identifiers for company services, employees and their devices. PKI is also used to secure communications and to secure sensitive data.
Organizations use PKI to provide security through public key encryption methods. The name Public Key Infrastructure reflects the essence of the system’s concept. Those parties that need to encrypt a message for the recipient use public keys. Only the recipient has the private key, which he uses to decrypt the message, and must not reveal to anyone else.
Initially, PKI security worked as follows – digital certificates were issued, which were proof of the identity of the certificate holder. These certificates were used as an authenticator in security systems the same way that a passport is used by citizens to verify their identity.
Today, PKI is used by people, devices, and applications. Sites have Transport Layer Security (TLS) certificates for secure communication with the user’s browser. Employees of enterprises use a digital signature for digital document management. Each element of the Internet of things has a digital identifier built into it at the factory to securely confirm the genuine identity of the device on the Internet.
The Public Key Infrastructure has a high reliability in computer networks. For example, an employee of an organization connects remotely to a data center and sends some data from his laptop on a server. Both devices need to somehow convey to each other that they are who they “say” they are. This is important, since potential attackers can impersonate the user or a process.
With PKI one can issue digital certificates. They allow reliable identification of both parties. This is possible by verifying the public key. If the PKI certificate was issued by a certificate authority that is trusted by both parties, the participants will be able to verify each other’s digital identities using their public keys.
PKI is at the heart of the communication security on the Internet. Visiting sites and sending emails does not work without PKI being configured properly. Digital file signatures, code signing, smart cards and data encryption also work thanks to PKI.
Public key and private key are terms that refer to asymmetric cryptography. In order to understand the differences between them, first you need to understand how it works.
Sender wants to send an encrypted message to a recipient. To do this, the recipient has a private key and public key paired with each other. The recipient sends the public key to the sender. To encrypt the message the sender uses the recipient’s public key. A message encrypted with this key can only be decrypted using the paired private key. Since the private key stays in the recipient’s possession , no one except him will be able to decrypt the message.
PKI uses cryptographic algorithms and principles. Let’s look at them more closely – more precisely at the building blocks of public key cryptography.
Cryptography is a mathematical science based on formulas and algorithms that are used to encrypt and decrypt data. There are many types of different cryptographic principles , but for the sake of article we will only consider those used in PKI for authentication.
Symmetric encryption is a process which uses cryptographic algorithms that operate with the same cryptographic key for both encryption and decryption. Consider a situation in which the sender forwards a message encrypted with a symmetric cipher to the recipient. The sender encrypts the message with a symmetric encryption algorithm that uses a single cryptographic key. After that, he sends an encrypted message to the recipient. The recipient receives the ciphertext and uses the same cryptographic key as the sender to decrypt it.
This type of encryption is called symmetric, since the same key is used for inverse operations – encryption and decryption. Downside of this approach is that it doesn’t completely solve the challenge of secure data transmission. . You see, not only the message, but also the encryption key must be transmitted in a secure manner. If the key gets intercepted by the third party, all transmitted messages can be easily decrypted. However, symmetric cryptographic algorithms also have significant advantage: their execution requires much less computing power compared to asymmetric encryption algorithms.
Asymmetric encryption involves the use of two cryptographic keys: one for encryption and one for decryption. These keys are interdependent mathematically. However, it is practically impossible to decipher the first private key from the second derivated public key.
For example, a sender wants to deliver a message encrypted with an asymmetric algorithm to a recipient. To do this, the sender encrypts the plaintext with the recipient’s public key and transmits the message. The recipient uses the private key to decrypt the message.
In order to send encrypted message the sender needs to know the public key of the recipient. Unlike in symmetric algorithms, the public key can be freely transferred without the risk of compromising the data from the message.. To decrypt a message the recipient must use the paired private key. The private key stays safely stored in recipients possession, without the need to share it with anyone.
Asymmetric encryption is devoid of the risks of symmetric encryption associated with possible compromise of the cryptographic key during transmission. However, such algorithms require significant computing power when compared to symmetric encryption algorithms.
Asymmetric encryption allows you to do more complex procedures with the original data that cannot be performed with symmetric algorithms. Examples of such operations can be digital signatures.
Symmetric encryption and asymmetric encryption are actively used today. Symmetric encryption algorithms are preferred when data in motion encryption is required. On the other hand, digital signatures are based on asymmetric algorithms. Both of these approaches can also be used to create hybrid encryption systems.
For example, parties use asymmetric encryption to securely transmit a symmetric encryption key. This method combines the advantages of both types of encryption. The risk of compromising the symmetric key is eliminated, and the increased computing power of the asymmetric algorithm is only required to transfer a small amount of data that contains the symmetric key.
Both symmetric and asymmetric encryption algorithms are vulnerable to one type of attack – the “man in the middle”. The essence of the attack lies in the assumption that there is an intruder waiting to intercept the message on the way from the sender to the recipient. Let’s say he manages to intercept the recipient’s public key used to encrypt the message. Then, the attacker will generate his own pair of cryptographic keys and send his public key to the sender instead. After that, the attacker will be able to read and change the data meant for the recipient at his discretion. In this case, neither the recipient nor the sender will be aware of this situation.
PKI solves this problem. Each participant in the data exchange is assigned a unique digital certificate with a public key, which is used by them to verify their identity. Before the exchange of data, the recipient sends a request for verification of such a certificate and its public key to the certification authority (CA) that issues those certificates. The CA uses the private key to verify that the sender’s certificate and public key really belongs to the sender and confirms it to the recipient.
PKI uses digital certificates to manage encryption keys. Digital certificates are created, assigned, and revoked in accordance with PKI design principles. The Certification Authority is responsible for setting certificate policy and certificate management standards, issuing and utilizing digital certificates.
The following analogy is often used to explain how digital certificates are used. Think of digital certificates as driver licenses and PKI as traffic police. Similarly, PKI works as a trusted party that is a guarantor of the security of communication between digital certificate holders.
Digital certificates contain information about who issued this certificate and to whom it was issued. Most often in the name of the owner you can find the legal name of the company. Certificates reliably protect against hacking in the same way that passports protect against identity theft. Same as driver’s license, all digital certificates have an expiration date and can be revoked if deemed necessary by security purposes.
Certificate Authority is a trusted party that creates and distributes PKI certificates. The role of the certification authority in this process is to ensure that the person to whom the unique certificate is issued is in fact who it claims to be.
This usually means that the certifier has an agreement with the institution that provides it with information to verify the identity the person claimed. CA are a critical component in PKI because they ensure that none of the two parties exchanging information are impostors.
It is assumed that before issuing a digital certificate, the future owner has already generated a pair of asymmetric keys. In this case the process of issuing a certificate usually consists of several sequential steps:
When a CA issues a new certificate to an owner it’s a document cryptographically signed by both parties. A CA can also issue a certificate to another intermediate CA that is done in the same way. But if we talk about the root CA it issues and signs its root certificate only on its own. How could we define the CA hierarchy and what is the important role of the root certificates in it?
Root certificates are the basis of all other certificates. In other words, the compromise of the root certificate is equal to the compromise of the master private key. This can lead to a whole cascade of hacks. Starting with user certificates that will no longer be trusted and ending with certificates issued for other CAs. All of them will cease to be reliable if the root certificate falls into the hands of an attacker.
For this reason, the root certificate security is the most advanced and reliable in the entire PKI system. These certificates are stored on physical media, which in turn are stored inside certified and secure safes. The safe room is guarded by video surveillance and security guards. Access to the premises is strictly regulated. In modern environments the private keys of the CAs can be stored in certified Hardware Security Modules – HSMs, that guarantee the full security of their storage and management.
In addition, an important security aspect of such certificates is not only their storage, but also their generation. It should take place only in a trusted environment of certified security devices – Hardware Security Modules, or simply HSMs. HSMs are equipped with a True Random Number Generator (TRNG) required to create a root certificate.
Sometimes CAs have to retrieve root certificates from safes. It is required for the generation of new certificates, public keys and private keys, as well as a confirmation of the legitimacy of previously created certificates. Another reason is to check the safety of the root certificate itself, and the absence of its substitution. Such procedures occur from 2 to 5 times a year.
And finally, root certificates must be replaced after a specified period of time for additional security reasons. Like all their affiliated certificates, the root certificates have a service life, after which they are subject to mandatory disposal.
Determining the Optimal Level of Tiers in Your PKI’s CA Hierarchy
The CA hierarchy looks like this: Root Certificate Authority -> Subordinate Certificate Authority -> End-Entity Certificates. Two types of CA are required for the convenient issuance of user certificates. Subordinate CA digital certificates have less security requirements, in particular, they can stay online longer to issue digital certificates to end users. If the Subordinate CA certificates are compromised, there is going to be a problem, but it will be easier to solve: one can usually revoke certificates issued with a compromised certificate of a Subordinate CA. This cannot be done with a Root Certificate.
Also, two layers of CA are needed to ensure the security of the Root Certificate Authority, which allows to keep the root certificate offline most of the time, avoiding the risk of it being compromised.. More layers could improve the security of the CA structure, but would lead to complications of the entire PKI and new challenges.
The Certification Authority periodically issues Certificate Revocation Lists, CRL lists of digital certificates that have been revoked and publishes it to the repository. Each CRL includes a next update field that specifies the time when the next CRL will be issued.
Any relying party that needs certificate status information and doesn’t already have a current CRL gets the current list from the store. If the certificate that the client is verifying is not in the list, then work continues normally and the key is considered to be a validated certificate. If the certificate is present in the list, then the key is considered invalid and cannot be trusted.
To improve performance, copies of the CRL can be spread across multiple stores. Each relying party needs the last up-to-date list in order to perform the check. Once a relying party receives the most recent CRL, it will not need to request additional information from the store until a new CRL is issued. As a result, during the period of time when the CRL is valid, each relying party will send no more than one request to the store for the CRL. This request will be made for the first time after the current CRL is issued.
There is also a delta CRL mechanism which is an optional mechanism. It can be used to improve the dissemination of revocation information. Delta CRLs are relatively small in size, containing only those changes in certificate revocation lists that have taken place since the last version of the absolute list (complete CRL) was compiled by the CA. Because delta CRLs are small, PKI clients can download them more often than complete CRLs, so the CA provides its clients with more accurate information about revoked certificates.
Digital certificates are verified using a chain of trust. The final link in this chain is the Root certificate. Its private key is used to sign other certificates. All certificates immediately below a root certificate inherit trust from that root certificate – signing with a root certificate can be compared to authenticating an identity by a notary public in the real world.
Many programs automatically classify these root certificates as trusted. For example, a web browser uses them to verify identity during a secure TLS connection. This means that users trust their browsers the CAs they trust and accordingly any intermediaries that those CAs gave the right to issue their own certificates to verify the identity and intent of all parties that own the certificates.
Your browser and our Helenix.com server are currently communicating via a PKI encryption process known as Secure Socket Layer or Transport Layer Security SSL/TLS:
After that, a secure SSL/TLS connection is defined as established.
There are many benefits to using a Public Key Infrastructure:
Authentication
Fraudsters are constantly improving ways to deceive users therefore authentication is a growing need. When information is communicated via a website, email, or text message, it is essential to obtain confirmation that the communication is with the intended organization or person. Through a validation process conducted by a CA and the use of a private and public key, PKI provides seamless authentication.
Confidentiality
One important element of security when it comes to online communication is privacy. After all, no one wants to reveal their passwords, credit card information, or personal information. By encrypting data between the sender and recipient, PKI secures the original data so that only the intended recipient can see the data in its original format.
Data integrity
When you send confidential information online both parties need the recipient to receive the data intact. Through a technique called “hashing” PKI allows the recipient to verify whether a message, document or data has remained in the same form or not.
Non-repudiation
PKI provides a digital signature mechanism. This serves as proof that the person who signed it is the real source of the data. And therefore, it also makes it impossible for the sender to deny that he was not the one who signed and sent it.
While there are many advantages of a Public Key Infrastructure and the encryption it provides, there are some specific disadvantages:
Speed
It requires a lot of computing resources to use a pair of keys in complex mathematical algorithms that PKI relies on. This leads to additional computational costs when encrypting data in large volumes. As a result, it slows down the data transfer process.
Private key protection
The cryptography behind PKI must be so strong that even supercomputers should not be able to break it during the time of practical use of the valid certificates. However all PKI security is independent of the cryptographic algorithms that are strong enough, It depends on the security of the private key, as it can decrypt any data encrypted with the paired public key.
If the private key is compromised an attacker can easily decrypt the encrypted data using this private key. Also attackers will be able to impersonate a server which private key they know in order to deceive clients. It is not difficult to imagine how much loss and damage this can bring to the company.
Certificate Authorities
One of the components of PKI are CAs. The role of Certificate Authorities is to check issued digital certificates and to issue new ones, as well as validate that certificates are issued only to those people or organizations who are supposed to. If the CA is compromised by attackers or employees’ negligence, it could be a security breach for millions of people and thousands of organizations who trusted this CA around the world.
PKI is one of the essential components of modern data protection systems. Like many other cybersecurity solutions, the right PKI solution must be selected and configured for every organization. Helenix has many years of experience in developing enterprise PKI solutions. Our solutions are based on the best practices, that is why we insist to use Hardware Security Module HSMs as a root of trust when developing PKI systems. You can learn more about our competencies in the Custom Development section.
PKI is a system for issuing digital certificates that are used to authorize users and devices. Thanks to public PKI, it is possible to verify that the parties are who they say they are and can securely exchange information with each other.
In a PKI the main components are the CAs that issue digital certificates, the users to whom they are granted, certificate registry lists of current and obsolete certificates, and the digital certificate database. The Registration Authority RA is not always necessary part of PKI.
Basically, there are three kinds of PKI structure. A simple PKI contains only one CA. An hierarchical PKI includes multiple CAs, some of them serve users and some of them serve intermediary CAs. There is no single master CA in a Network PKI, unlike an Hierarchical PKI.
PKI is required to ensure the protection of corporate data. When not using PKI a company exposes itself to enormous risks. In particular its communication systems can be vulnerable to a “man in the middle” attacks.
Managed Public Key Infrastructure MPKI is a type of PKI in which an organization trusts a third party to deploy and maintain the PKI. Such products are actively used in cloud environments as cloud PKI.